25 Sep 2019

---

Time for a cyber security review?

• Provide security training— Even the most robust and expensive data protection solutions can be compromised if an employee clicks on a malicious link or downloads fraudulent software. It's critical for organisations to train personnel on common cyber-threats and how to respond. Employees should understand the dangers of visiting harmful websites, leaving their devices unattended and oversharing personal information on social media. Your employees should also know your cyber-security policies and know how to report suspicious activity.

• Install strong antivirus software and keep it updated—Strong antivirus software is one of the best ways to protect your data. Organisations should conduct thorough research to choose software that’s best for their needs. Once installed, antivirus programs should be kept up to date.

• Instil safe web browsing practices—Deceptive and malicious websites can easily infect your network, often leading to more serious cyber-attacks. To protect your organisation, employees should be trained on proper web usage and instructed to only interact with secured websites. For further protection, companies should consider blocking known threats and potentially malicious webpages.

• Create strong password policies—Password management can help prevent unauthorised attacks. Your password policy should require employees to change their password on a regular basis, avoid using the same password for multiple accounts and to use special characters in their password.

• Use multi-factor authentication—While complex passwords can help deter cyber-criminals, they can still be cracked. To further prevent cyber-criminals from gaining access to employee accounts, multi-factor authentication is key. Multi-factor authentication adds a layer of security that allows companies to protect against compromised credentials. Through this method, users must confirm their identity by providing extra information (eg a phone number, unique security code) when attempting to access corporate applications, networks and servers.

• Get vulnerability assessments—The best way to evaluate your company’s data exposures is through a vulnerability assessment. Using a system of simulated attacks and stress tests, vulnerability assessments can help you uncover entry points into your system. Following these tests, security experts compile their findings and provide recommendations for improving network and data safety.

• Patch systems regularly and keep them updated—A common way cyber-criminals gain entry into your system is by exploiting software vulnerabilities. To prevent this, it’s critical that you update applications, operating systems, security software and firmware on a regular basis.

• Back up your data—In the event that your system is compromised, it’s important to keep backup files. Failing to do so can result in the loss of critical business or proprietary data.

• Understand phishing threats and how to respond—Cyber-criminals use phishing to gather personal information. In these scams, phishers send an email or direct users to fraudulent websites, asking victims to provide sensitive information. These emails and websites are designed to look legitimate and trick individuals into providing credit card numbers, account numbers, passwords, usernames or other sensitive information. Phishing is becoming more sophisticated, and it’s important that you and your employees understand the different types of attacks, how to identify them and preventive measures you can implement to keep your organisation safe.

• Create an incident response plan—Most organisations have some form of data protection in place. While these protections are critical for minimising the damages caused by a breach, they don’t provide clear action steps following an attack. That’s where cyber-incident response plans can help. Response plans allow organisations to notify impacted customers and partners quickly and efficiently, limiting financial and reputational damages.

With thanks to Zywave for the article content.